EMV is Here—Is Your Business Ready?
New credit card technology could help protect you and your customers from fraud and financial liability, plus get a jump on your competition.
Perhaps you’ve noticed that credit cards are looking a little different these days. Many are sporting a new feature — a gold square on the front of the card like this one:
That square, or contact, indicates that a microprocessor chip (think of it as a mini computer) is embedded in the card and provides the basis for new payment card technology that is sweeping the United States. It’s called EMV it’s the future of U.S. credit card processing and it will affect your business in more ways than one.
What is EMV?
EMV is an established global standard for credit and debit cards that’s based on microchip technology. The acronym evolved from a collaborative effort undertaken in Europe in 1994 by Europay, MasterCard and Visa to ensure payment security and global interoperability. Today the EMV trademark is owned by the six member organizations of EMVCo: American Express, Discover, UnionPay, JCB, MasterCard and Visa.
Simply put, the EMV chip is replacing the magnetic stripe that has been a standard feature on payment cards issued in the United States for nearly half a century. The reason for the change is that chip technology is considered significantly more secure than magnetic stripe because it uses encryption and other cryptographic measures that make it extremely difficult for unauthorized users such as hackers and identity thieves to access or use information on the card, or to create duplicate cards. Additionally, since the technology has been adopted globally, the transition to chip cards in the United States ensures that international visitors to this country will encounter no roadblocks when they present their EMV cards at the point of sale.
EMV’s stronger authentication features are expected to help lower the payment card fraud rate in the United States. According to The Nilson Report, the United States accounted for 47.3 percent of the worldwide payment card fraud losses in 2012 while generating only 23.5 percent of total volume. The need for a solution to this costly problem ($5.33 billion in the United States alone in 2012) is clear.
EMV has already been tested and found effective at combatting fraud and identity theft in other countries where it has been implemented. For example, Canada began its migration to EMV in earnest in 2007. In 2010, Criminal Intelligence Service Canada released a report showing the combined losses due to payment card fraud had decreased from $512.2 million to $500.7 million between 2008 and 2009 — small but significant progress in the right direction.
How EMV Works So-called “smartcards” look like traditional magnetic stripe cards; in fact, the cards being issued by banks in the United States during the transition period feature both a stripe and a chip so they can be used in point-of-sale systems that are not yet EMV compatible. The chip contains the account and personal information needed to use the card for payment, backed up by more advanced security features than are available on mag stripe cards.
Instead of swiping an EMV card through a credit card terminal, as is done with a magnetic stripe card, the cardholder “dips” or inserts it into a device that allows the chip to connect to a reader, become energized and exchange data. This is known as a contact transaction.
Alternatively, there is another type of chip card technology that doesn’t require direct physical contact between the card and the reader. For this contactless transaction, the cardholder simply holds the chip card within a couple of inches of a contactless-capable reader, which connects with the embedded chip and allows the exchange of data via radio frequency in a process known as near field communication. The contactless method is sometimes referred to as “tap and go” because it is so quick.
Chip-and-PIN vs. Chip-and-SignatureEMV cards come in two versions: chip-and-PIN and chip-and-signature. The main difference between them is how they’re authenticated at the point of sale. Chip-and-PIN cards account for about 60 percent of EMV cards worldwide and require the cardholder to enter a four-digit code to complete the transaction. Chip-and-signature cards require the cardholder’s signature to verify the sale.
Just as EMV cards are considered to be more secure than magnetic stripe cards, chip-and-PIN cards are a stronger defense against fraud than chip-and-signature cards. That’s because it’s easy for a thief to forge a signature but far more difficult to guess a cardholder’s PIN.
Why are U.S. banks primarily offering chip-and-signature to their cardholders, even after the Obama administration issued an executive order requiring that federal agencies migrate to more secure chip-and-PIN based credit cards for all federal employees that are issued payment cards?
Brian Krebs explored that question recently on his blog, Krebs on Security. He spoke with Julie Conroy, a fraud analyst with The Aite Group, who explained that issuers told her they “wanted to keep it simple: Go to market with plain vanilla (chip-and-signature), and once we get this working, we can evaluate adding some sprinkles and toppings later (chip-and-PIN).”
Another industry analyst, Avivah Litan of technology research firm Gartner Inc., told Krebs that once magnetic stripe goes away completely (she predicted by 2018), chip-and-PIN will be a “very strong solution.” She added that current estimates are that half of the cards and terminals will be chip-enabled by the end of 2015, although full compliance will take a little longer.
Achieving EMV Compatibility
As a merchant, there are certain steps you should be taking now to achieve EMV compatibility, not only for the security benefits if offers your business and your customers, but also to be prepared for the liability shift that will occur later this year. Currently, issuing banks are financially responsible for any credit card fraud that occurs at the point of sale. However, beginning October 1, merchants (excluding fuel dispensers) who haven’t upgraded their POS credit card processing equipment to support EMV transactions will be financially responsible if a counterfeit or fraudulent transaction occurs on that card. Fuel dispensers have an additional two years to become compliant before the liability shifts to them.
By upgrading to EMV-compatible terminals now, you’ll help protect yourself from financial liability and fraud, you’ll be ahead of your competition and you’ll be able to process sales without missing a beat as increasing numbers of your customers present their new chip cards at the POS.
Start the process by evaluating your current risk level. Have chargebacks been an issue? Is your business a larger retailer, or do you sell big ticket items that would potentially increase the risk of expensive counterfeit transactions? If so, you should strongly consider incorporating EMV credit card processing equipment at your place of business now.
EMV compliant terminals still support traditional payment processing, and most are comparable in cost to traditional credit card machines. Costs associated with adopting EMV technology can be offset by the increased security and reduced risk of fraudulent transactions, as well as the potential expanded marketplace that EMV compatibility brings.
Kevin Kobs is vice president of business development at TransFirst.